1 Answer
1

Obviously this would best be answered by the one(s) in charge of the API design, but here is my analysis:

The two reputation datasets are shaped quite differently indeed and this does matter in various ways - as such I expect this to be more or less status-bydesign:

Dataset shape

The reputation audit is composed of individual reputation change events at the time they occur, i.e. any event triggering a change in a users reputation is logged with a single entry, grouped by day.

The reputation route is composed of accumulated reputation changes per post they apply to if affected within selected time frame, i.e. a post will only be included in the result if there has been one ore more reputation change events within the selected time frame; the ondate field seems to denote the most recent reputation change date accordingly.

Further observations/implications

Reputation changes from down votes on other posts are included in the audit but are excluded from the route because this would compromise anonymous voting otherwise (see my answer on a related feature-request as well).

Reputation changes from bonuses are included in the audit but not in the route as you observed already; this makes sense in so far they cannot be assigned to any particular post.

Reputation changes from bounties on the other hand are included in the route as well; as with all other posts they will be listed with the most recent reputation change date, be it the bounty or any other activity.

Reputation changes from accepting answers are definitely missing; for this I don't see any reason in principle and it might be qualified as a bug therefore, but see Conclusion below for another point of view.

Finally there has been an off by one day issue between audit and API while exploring all this which I've not investigated any further, but this may account for minor differences in the result as well.

Conclusion

The API design will allow to replicate the reputation graph quite well, but not so the reputation audit, the latter being partially enforced by the needs to protect the anonymity of down votes.

While the missing reputation for accepting an answer could be qualified as a bug indeed, fixing it would defeat rebuilding the reputation graph feature, where these points are excluded as well.

All in all the main differences observed seem to stem from the distinct dataset shapes (i.e. I haven't analyzed any difference in the result set at hand in detail and it is still irritating that the API results are noticeably higher despite the missing points from accepting answers).

Whether this dataset shape has been chosen deliberately like so or been more or less naturally deduced from the reputation features available is not mine to speculate about.